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ABSTRACT 


The purpose of this research is to determine whether there are differences in perceptions 
between approving officials (AOs) and cardholders (CHs) regarding internal controls 
within the Government Purchase Card Program (GPCP) at the Naval Postgraduate School 
(NPS). A main component of the research is a voluntary and anonymous online survey 
deployed to the AOs and CHs at NPS. Results from the analysis of the survey data can be 
used to identify areas of improvement within the GPCP. 

Based on the data analysis, there were eight significant differences in perceptions 
of internal controls between AOs and CHs. They were identified in three of the five 
internal control components: risk assessment, information and communication, and 
monitoring activities. The data analysis revealed that AOs generally responded more 
positively than CHs, implying that AOs may perceive the strength of the GPCP’s internal 
controls to be stronger than the CHs perceive them. In addition, there were survey items 
to which both AO and CH responded strongly, which included such things as password 
protection, separation of duties, and adequate fraud education. Both strong and weak 
internal controls have implications on auditability. The analysis identified potential 
implications of internal controls, or lack thereof, on auditability within the GPCP at NPS. 
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I. 


INTRODUCTION 


In this chapter, the baekground and purpose of this researeh is presented, and the 
researeh questions are addressed. The benefits and limitations, in addition to the 
importanee of this researeh, are also diseussed. Finally, the methodology is briefly 
outlined, and the seope and organization of the researeh are presented. 

A. BACKGROUND 

The Department of Defense (DOD) and the Department of the Navy (DON) 
purehase eard programs proeess hundreds of thousands of transaetions aeeounting for 
billions of dollars annually. In 2013, the federal government’s 300,900 eardholders (CHs) 
spent $16.5 billion on 18.9 million transactions (GSA, n.d.-c). The Government Purehase 
Card Program (GPCP) was developed as a tool to support streamlining initiatives and 
was intended to have eost savings applications in the federal government, the DOD, 
DON, and the Naval Postgraduate Sehool (NPS). The purehase eard is used in many 
organizations to streamline the proeurement proeess. 

Following the Executive Order 12,931 (1982) to reduce eosts and the suceessful 
pilot phase for a purehase eard program in 1986, the federal government began the use of 
a government-wide purehase eard program in 1989. While the program was somewhat 
sueeessful, due to the weak internal eontrols and misuse over time, additional legislative 
aetions were put in plaee, and the program evolved over the years. In 1998, the General 
Serviees Administration (GSA) SmartPay Program was established “to serve as the 
premiere eharge eard program for the United States federal government, serving more 
than 350 federal ageneies and organizations” (GSA, 2012). In 2008, the federal 
government spent $30.6 billion on the eommereial eard, whieh ineludes the travel, fleet, 
and purehase eards, and 65% of that was spent on the purehase eard alone (Palmer, 
Gupta, & Dawson, 2010). 

The GPCP direetives provide very speeific rules, regulations, and responsibilities 
for all key personnel, ineluding approving offieials (AOs) and CHs, in order to maintain 
proper training, follow eapable proeesses, and implement effeetive internal eontrols 
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(Rendon & Rendon, 2014). The DOD is tasked with being auditable by 2017; therefore, 
the program’s specific requirements are crucial in the current fiscal environment. Recent 
requirements for strong internal controls and the Managers’ Internal Control Program 
(MICP) need to be implemented to ensure organizations are in compliance with internal 
control directives and policies. 

The GPCP at NPS provides a “fast and convenient method to pay for all 
requirements under the micro purchase-threshold” (NPS, 2012, p. 1) of $3,000 for 
civilian and military personnel. In fiscal year (FY) 2012, the NPS GPCP processed 
approximately 21,000 transactions that accounted for approximately $24 mi llion 
(M. Morales, personal communication, July 24, 2013). Although the GPCP may be 
convenient and realize costs savings, an analysis of the perceived internal controls and 
implications to auditability is warranted to ensure compliance with established internal 
control policies and procedures. 

B. PURPOSE OF RESEARCH 

The purpose of this research is to determine whether there are differences in 
perceptions between AOs and CHs regarding internal controls within the GPCP at NPS. 
A main component of the research is a voluntary and anonymous online survey deployed 
to the AOs and CHs at NPS. Results from the analysis of the survey data can be used to 
identify areas of improvement within the GPCP. This research also potentially identifies 
any implications of the perceived differences of internal controls on the auditability of the 
GPCP at NPS. 

C. RESEARCH QUESTIONS 

The research questions for this research are as follows: 

• What are the differences in perceptions of internal controls between the 
approving officials and cardholders in the Government Purchase Card 
Program at the Naval Postgraduate School? 

• What are the implications to auditability from the differences in 
perceptions of internal control between approving officials and 
cardholders within the Government Purchase Card Program at the Naval 
Postgraduate School? 
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D. BENEFITS AND LIMITATIONS 


This research benefits the DON, and more specifically, NFS, by analyzing the 
AOs’ and CHs’ perceptions of the internal controls within the GPCP at NFS. The results 
of the analysis are used to identify recommendations to strengthen the internal controls 
within the GPCP at NFS. In addition, this research potentially identifies the impact that 
those differences in perceptions of internal controls have on the auditability of the GPCP 
at NFS. 

The limitations of this research include the limited number of participants who 
complete the voluntary anonymous online survey. Although NFS allowed access to all of 
its AOs and CHs, the survey was voluntary, so not all potential participants chose to 
participate. Another possible limitation is the survey instrument itself. It was a 
combination of surveys used by other researchers, but it may have been limited in the 
type of questions it asked with regard to the GPCP. 

E. IMPORTANCE OF RESEARCH 

The importance of this research is that the GPCP is a government-wide program 
responsible for processing hundreds of thousands of transactions and accounting for 
billions of dollars a year. To ensure the program is managed in accordance with policy 
and regulations, it is imperative to understand the internal controls within the GPCP. This 
research assesses the perceptions of internal controls by both AOs and CHs and makes 
recommendations to the GPCP at NFS. 

F. METHODOLOGY 

This research includes a literature review, the development and distribution of the 
online survey, and an analysis of the responses to the survey. The literature review 
includes a review of scholarly peer-reviewed articles, which are related to internal 
controls and purchase cards. Government Accountability Office (GAO) reports, 
government policies, and DOD and DON instructions. 

The online survey was developed using a previously validated internal control 
survey as well as other sources. The survey consisted of demographic survey items and 
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Likert-based survey items regarding internal controls. The survey was deployed to AOs 
and CHs at NFS using the web-based survey software, LimeSurvey. Once the survey was 
deployed, it was available for three weeks. 

After the survey period was over, the data collected from the survey responses 
was reviewed and analyzed as it related to the five internal control components. 
Descriptive statistics was used in the data analysis using SPSS. 

G. SCOPE AND ORGANIZATION 

This research paper contains six chapters, including the introduction. Chapter II 
includes a literature review covering the industry purchasing card and the GPCP and its 
application to the federal government, the DOD, and the DON. The chapter also 
discusses internal controls and auditability, including supporting legislation. Chapter III 
discusses NFS’s use of the GPCP, including the mission, the Contracting and Logistics 
Management organization, and the GPCP organizational structure. Chapter IV presents 
the methodology used to conduct the research and to develop and deploy the online 
survey. Chapter V analyzes the survey results, discusses the findings and the implications 
of the findings, and offers recommendations based on the findings. Chapter VI 
summarizes the research and provides conclusions and areas for further research. The 
following section provides a summary of this chapter. 

H. SUMMARY 

This chapter presented the background and purpose of this research and addressed 
the research questions. The benefits and limitations, in addition to the importance of this 
research were also discussed. Finally, the methodology was briefly outlined, and the 
scope and organization of the research were presented. The next chapter provides a 
literature review of the purchase card program and internal controls. 
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II. LITERATURE REVIEW 


A. INTRODUCTION 

This chapter presents the evolving role of the purchasing function and the industry 
purchase card program. The Government Purchase Card Program (GPCP) and its 
application in the federal government, the Department of Defense (DOD), and the 
Department of the Navy (DON) are then discussed. The Naval Postgraduate School 
(NPS) GPCP will be discussed in Chapter III. In addition, corporate governance is 
addressed, which includes auditability, the Sarbanes-Oxley Act of 2002 (SOX), and 
Committee of Sponsoring Organizations of the Treadway Commission (COSO). 
Furthermore, the integrated internal control components are discussed as well as internal 
controls in the federal government. The next section discusses the evolving role of the 
purchasing function. 

B. THE EVOLVING ROLE OF THE PURCHASING FUNCTION 

In most organizations, purchasing is a basic function used to acquire goods and 
services to accomplish the goals of the organization. Purchasing also contributes to the 
success of the organization and, in some cases, has more impact on the bottom line than 
other business functions (Burt, Dobler, & Starling, 2003). Throughout the history of 
purchasing, many changes have significantly shifted supply managers’ perspectives of 
the purchasing department and its importance to the organization. 

Purchasing has long been considered a subordinate function to research and 
development, finance, marketing, and operations; however, it has developed into a 
strategic management function, with high value placed upon cost savings and increased 
efficiency and effectiveness (Burt et ah, 2003). In the 1960s and 1970s, inventory was 
managed with a manual system, and the focus at the time were purchase price and 
preventing production line shutdowns. In the late 1970s, computers began to help with 
inventory management at the same time that automation in the production process was 
increasing, which drove unit production costs down. In the 1980s, managers began to 
manage their inventories more carefully and started to utilize computer-generated 
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materials requirement plans, which in turn reduced inventory levels, decreased costs, and 
increased efficiency. Finally, in the late 1980s, managers included supply management in 
their organizations’ strategic business plans and increased the focus on purchasing 
departments (Burt et ah, 2003). The historical focus was purchase price as well as supply 
continuity; however, today the focus is on value-adding benefits such as quality, cost, 
time, technology, and supply continuity. 

Major developments in the purchasing function involve the area of supply 
management, which includes cross-functional teams, supply chains and networks, supply 
alliances, strategic sourcing, and e-procurement. Cross-functional teams combine 
members of different functional areas to find solutions to problems, demonstrating team 
behavior and developing leadership skills (Burt et ah, 2003). Cross-functional team 
participation in the development of supply chains and networks identifies desirable 
suppliers by identifying which value-added activities are most important to the 
organization’s strategic supply plan (Burt et ah, 2003). Once the supply chains and 
networks are identified, supply alliances are fostered through mutually beneficial 
relationships (Burt et ah, 2003). Furthermore, supply management personnel must decide 
the appropriate relationship with each supplier in order to accomplish organizational 
goals and objectives. 

Management has also shifted its thinking about using sources strategically. 
Strategic sourcing is an organized approach that utilizes the supply base to achieve the 
organization’s objectives. Strategic sourcing also integrates suppliers into long-term 
plans and improves the organization’s value. Lastly, Burt et al. (2003) stated that 
“e-procurement is one of the most exciting developments in supply management” (p. 33). 
Technologies that enhance business operations have emerged. Buyers are no longer 
required to process paperwork since they can now place orders over the Internet directly 
to suppliers. This is a major development for the purchasing department, and the use of 
technology supports streamlining and strategic sourcing initiatives. 

Leenders and Fearon (1997) discussed the advantages of both a centralized and 

decentralized purchasing department. The advantages of centralization include a 

standardized purchasing process and decreased administrative duplication. Therefore, that 
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results in an increase in the number of contracts for large quantities of items for the 
organization. However, decentralizing the purchasing authority allows independent 
department managers to handle their own purchasing since they are more familiar with 
the department’s specific requirements (Leenders & Fearon, 1997). Decentralized 
authority also gives the purchaser more flexibility, which necessitates an additional 
emphasis on internal controls to help ensure that purchasers are in compliance with 
established purchasing policies and procedures. While these developments are helping 
streamline purchasing initiatives, there appears to be a small-order problem, which is 
discussed in the next section. 

1. Small-Order Problem 

Leenders and Fearon (1997) and Burt, Petcavage, and Pinkerton (2010) 
discovered that small orders are a problem in most organizations. Burt et al. (2010) gave 
an example of a typical company in which a large percentage (sometimes as high as 80%) 
of its purchases involved a purchase of less than $250. However, these purchases 
represented a small percentage (close to 10%) of the organization’s total annual spending. 
With the current purchasing department organization, the transaction cost to purchase a 
small-value item is likely more than the item cost itself (Monczka, Hanfield, Giunipero, 
and Patterson, 2011). Thus, the organization is spending more time and money on small 
purchase transactions. Leenders and Fearon (1997) offered approaches to simplify or 
automate the purchasing process, reduce cycle time, lower costs, and increase the buyers’ 
time spent on high-value orders. One solution to the small-order problem was the use of 
purchase cards distributed to internal customers to order directly from suppliers, which 
was one of the new streamline initiatives supported by e-procurement. The process of 
moving the small-value purchasing activity to the department’s cardholder reduces cycle 
time and transaction costs (Burt et ah, 2003). In addition, the transition of small-value 
purchasing allows the purchasing agents to concentrate their time on higher value 
purchases (Leenders & Fearon, 1997). Therefore, a tool most organizations considered 
central to improving the purchasing process was the purchase card (Monczka, et ah, 
2011). 
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The use of purchase cards and the implementation of the purchase card program is 
a solution to the small-order problem. The purchase card is used to pay for items of small 
value, including maintenance, repair, and operating (MRO) items. MRO items do not 
become part of an organization’s product, but they are essential for operating the 
business. This includes “spare machine parts, office and computer supplies, and cleaning 
supplies” (Monczka et ah, 2011, p. 74). Some organizations set a purchase threshold limit 
that cardholders cannot exceed when purchasing MRO items. The National Association 
of Purchasing Card Professionals (NAPCP, 2013a) website states that “P-Cards were 
introduced as, and continue to be, corporate (organization) liability/central pay payment 
vehicles for which payment in full must be made by the end user organization to the card 
issuer at least monthly” (para. 3). This attribute of a P-Card remains the primary 
distinction from consumer and small business credit cards. 

Other commercial card products include the travel card, corporate card, fleet card, 
one card, prepaid card, declining balance card, and business card (NAPCP, 2013d). They 
are all intended to address different types of purchases; however, this research focuses on 
the P-Card, as it is most similar to the purchase card used in the GPCP. 

This section discussed the evolving role of the purchasing function and the small- 
order problem. In addition, it discussed how the purchase card is a solution to that 
problem. The next section discusses the use of the P-Card in industry. 

C. INDUSTRY P-CARD PROGRAM 

The industry purchase card, also known as a P-Card, is a credit card that allows 
end-user organizations to utilize the existing credit card infrastructure to make business- 
to-business payments for a variety of business expenses, such as goods and services 
(NAPCP, 2013c, para. 1). After the purchase card was developed and introduced to the 
U.S. federal government for the General Services Administration (GSA), the P-Card was 
introduced to industry in the 1980s. The P-Card is most commonly used in the corporate, 
education, and government sectors. The P-Card is similar to a consumer credit card; 
however, the end-user organization using a P-Card must pay the card-issuing bank 
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the full balance on a monthly basis, instead of monthly minimum payments until the 
credit card bill is paid off. For low-value purchases, which are considered less than 
$2,500, respondents of a 2010 survey reported that purchase cards now handle 44% of all 
transactions (Palmer & Gupta, 2010). In 2009, large market industry organizations had 
449 P-Cards and made approximately 8.6 monthly transactions per card, and spent a 
monthly average of $1.03 billion (Palmer & Gupta, 2010). Large market statistics include 
companies with annual sales of $500 mi llion to $2 billion (Palmer & Gupta, 2010). 

The P-Card program in industry was developed to streamline payment and reduce 
costs for purchasing small-value items, which helps solve the small-order problem that 
was previously discussed. The P-Card program is a valuable asset to most organizations. 
The P-Card program involves the use of a credit card that allows an organization’s 
employees, also known as a cardholder, to make small-value purchases in a timely and 
efficient manner. The P-Card program also expedites supplier payments and reduces 
or eliminates the paperwork associated with a paper transaction (Gupta & Palmer, 2008). 
P-Cards have proven their value in improving efficiencies, decreasing processing costs, 
and decreasing cycle time (Palmer & Gupta, 2010). Transaction costs have decreased by 
76%, and cycle time was reduced by 72% (Palmer & Gupta, 2010). The future goals of 
the P-Card include such things as increasing convenience and reducing transaction 
processing (Palmer & Gupta, 2010). 

The industry P-Card program also has the option to implement internal controls, 
including single-purchase spending limits, monthly limits, and other restrictions 
(NAPCP, 2013b). Internal controls are discussed later in this chapter, and other sections 
discuss the application of a purchase card program in multiple settings, to include the 
federal government, the DOD, and the DON. The next section provides an overview of 
the roles and responsibilities within an industry P-Card program. 

1. Roles and Responsibilities within an Industry P-Card Program 

This section provides an overview of the roles and responsibilities of the entities 
involved in a P-Card program. Those roles include cardholders, end-user organizations, 
issuers, merchant acquirers, networks, and processors. 
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Cardholders are responsible for making purchases and payments on behalf of the 
end-user organization. Cardholders are expected to follow the end-user organization’s 
specific policies and are responsible for reviewing and approving transactions at least 
monthly (NAPCP, 2013b). End-user organizations receive the invoices from cardholders’ 
P-Card transactions and are responsible for paying the balance in full monthly. The end- 
user organization assumes liability for payment (NAPCP, 2013b). Issuers work directly 
with the end-user organizations to issue P-Cards and invoice P-Card transactions. 
According to NAPCP (2013b), issuers are often financial institutions, and they work with 
networks and processors to issue cards, authorize transactions, and provide data. 

According to the NAPCP (2013b), merchant acquirers “enroll suppliers in the 
card acceptance process and implement required solutions related to this purpose. In 
addition, they facilitate payment flow, including payment to suppliers,” (para. 3). 
Networks facilitate the movement of transactional data between the issuer and merchant 
acquirer and set the rules pertaining to P-Card acceptance by suppliers (NAPCP, 2013b, 
para. 4). Examples of networks include Visa, MasterCard, and American Express. 
Processors “provide various services to card issuers and merchant acquirers, which may 
include card production, statement printing, authorization, and data delivery” (NAPCP, 
2013b, para. 5). 

It is important to know the roles and responsibilities previously described to 
understand the interrelationships between cardholders, end-user organization, issuers, 
merchant acquirers, networks, and processors. Each participant plays a significant role in 
the success of a P-Card program. The P-Card process and the relationship between all of 
the entities involved are illustrated in Appendix A. This section discussed the use of the 
P-Card in an industry P-Card program and provided an overview of the roles and 
responsibilities within an industry P-Card program. Just like in industry, the federal 
government also has a purchase card program. The next section will review the GPCP. 
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D. GOVERNMENT PURCHASE CARD PROGRAM 


The government’s interest in purchase cards began in 1982 as a procurement 
initiative reform (Gupta & Palmer, 2008). After the successful pilot phase in 1986, the 
government began utilizing the purchase card program in 1989 when the first 
government-wide purchase card contract was awarded by the GSA to the Rocky 
Mountain BankCard System. In 1993, the United States’ Vice President’s National 
Performance Review further streamlined the purchase card process and reduced the 
red tape to make a purchase under the micro-threshold of $2,500. In October 1994, the 
Federal Acquisition Streamlining Act (FASA) of 1994 and Executive Order 12,931 
(1994) were established to further promote the use of the purchase card. In 2002, when 
the purchase card program was at risk due to General Accounting Office (GAO, 2003) 
and Inspectors General report findings of misuse, agencies were told to review their 
internal controls associated with minimizing risk in the purchase card program (Gupta & 
Palmer, 2008). In 2006, the micro-purchase threshold was increased from the previous 
$2,500 to the current threshold of $3,000. The government is continuously striving to 
improve the various aspects of the GPCP, including internal controls. 

Prior to the use of purchase cards, the government used the traditional paper- 
based procurement process, such as purchase orders, to place orders; however, that 
offered little flexibility and no accountability or oversight nor did it solve the small order 
problem. Thus, one of the major benefits of using purchase cards is that it helped solve 
the small-order problem. Another benefit of using the purchase card is the “ability to 
streamline transaction processing, increase accountability, and provide agencies with a 
more efficient and effective means of monitoring large numbers of transactions, and 
identifying fraud, waste, and abuse in the program” (GSA, n.d.-a). The Office of 
Inspector General (OIG, 2014) defines fraud, waste and abuse on its website. Fraud is 
“a type of illegal act involving the obtaining of something of value through willful 
misrepresentation. Waste relates primarily to mismanagement, inappropriate actions, and 
inadequate oversight. Abuse involves behavior that is deficient or improper as well as 
misuse of authority or position for financial interests,” (OIG, 2014, paras. 2, 5, 6). The 
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various government actions enabling the government-wide purchase card program over 
the years are shown in Table 1. 


Government Actions 

Year 

Executive Order 12352 

1982 

Pilot Phase of a Government Commercial Credit Card 

1986 

Introduction of Government-Wide Purchase Card System 

1989 

National Performance Review (NPR) Recommendations 

1993 

Federal Acquisition Regulation (FAR) Interim Rule 

1994 

Federal Acquisition Streamlining Act (FASA) 

1994 

Executive Order 12931 

1994 

Introduction of SmartPay 

1998 

Office of Management and Budget Memo 

2002 

Proposed Eegislation 

2005 

Revised 0MB Circular A-123 

2006 

0MB Circular A-123, Revised Appendix B 

2009 


Table 1. Government Actions Related to the Purchase Card Program 
(after Gupta & Palmer, 2008, p. 177) 


The GPCP implements streamlining initiatives and offers a solution to the small- 
order problem, which is discussed later. The federal government application of the GPCP 
is discussed next. 

1. Federal Government Application of the Government Purchase Card 
Program 

The GPCP, now known as the GSA SmartPay Program, partnered with national 
banks to provide purchase cards to over 52 federal agencies/departments and non- 
independently reported agencies throughout the U.S. government to support streamlined 
acquisition initiatives. The GPCP is intended to “streamline the small purchase and the 
payment process, minimize paperwork, eliminate imprest fund transactions, and generally 
simplify the administrative effort associated with procuring goods and services under 
the micro-purchase threshold” (“Government Purchase Card [GPC] Program,” 2013, 
para. 1). According to the Federal Acquisition Regulation (FAR) 2.101 (2014), a micro¬ 
purchase is an acquisition of supplies or services using simplified acquisition procedures. 
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where the total amount of the purchase does not exceed the micro-purchase threshold, 
which is currently set at $3,000. 

The following sections discuss the small-order problem and the use of the 
purchase card in the federal government. In addition, an overview of the roles and 
responsibilities and the training requirements are discussed regarding the federal 
government GPCP. 

a. Small-Order Problem as Related to the Federal Government Purchase 
Card Program 

The implementation of the purchase card program is beneficial to the government 
because it increases savings and decreases costs and transaction times associated with 
small orders. Once the purchase card is in the hands of customers, they can streamline 
purchasing and eliminate the use of purchasing agents, which helps lower the transaction 
costs of items. Involving a purchasing agent in a lower value purchase would likely 
outweigh the cost of the item; thereby, emphasizing the value of the purchase card 
(Monczka et al., 2011). Palmer et al. (2010) determined from their research that, “The 
best estimate of government cost savings from driving a paper-based approval and 
payment process to a purchase card is $69 per transaction” (p. 324). The government will 
realize more cost savings as more transactions are being paid for by the purchase card 
(Palmer et al., 2010). Gupta and Palmer (2008) found that purchases under the micro¬ 
purchase threshold accounted for only 2% of total federal government spending, but 
85% of all procurement transactions. That is a significant majority of the purchasing 
requirements. This finding reinforced the fact that the small-order problem is prevalent in 
the federal GPCP and illustrated the importance of the purchase card. The next section 
discusses the use of the purchase card in the federal government and metrics in the 
current fiscal environment. 

b. Purchase Card Use in the Federal Government 

The federal government has recognized the benefit of the purchase card since the 
initial legislation that introduced it in 1982 (Palmer et al., 2010). Since the inception of 
the program, the pressure to utilize the purchase card increased, enabling the program to 
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grow, until recently. Since 2000, the government purchase card has “accounted for 65 to 
70 percent of commercial card spending” (Palmer et ah, 2010, p. 317). The federal 
government uses the term commercial card to refer to the travel, fleet, and purchase 
cards. For example, in 2008, the government spent $30.6 billion on the commercial card, 
$19.8 billion of which was spent on the purchase card (Palmer et ah, 2010). However, 
researchers agreed that the program’s growth has slowed due to maturation and is now on 
a slow decline (Gupta & Palmer, 2008; Palmer et ah, 2010). That is not surprising due to 
the current fiscal environment. 

In their study on purchase card use. Palmer et al. (2010) compared the number of 
cards, transactions, and total spending over six fiscal years, from 2008 to 2013. The 
number of cardholders was close to 357,000 in 2008 (Palmer et al., 2010), compared to 
300,900 in 2013 (GSA, n.d.-c). This decrease in cardholders is in keeping with several 
government reports that encourage lowering the number of cardholders to gain more 
control over the program and reduce fraud, waste, and abuse (GAO, 2008). The number 
of transactions has been in a steady decline, from 25.5 million in 2008 (Palmer et al., 
2010) to 18.9 million in 2013 (GSA, n.d.-c). It appears as though the government may not 
be utilizing the program to its full potential, and therefore, may not be realizing the total 
benefits. In addition, the total purchase card spending was at a high of $19.8 billion in 
2008 (Palmer et al., 2010) and was at a low of $16.5 billion in 2013 (GSA, n.d.-c). This 
decrease may be due to the major budget cuts in the federal government. The purchase 
card program has been very beneficial to the government by moving the purchasing 
authority to the customer, reducing transaction time, and increasing cost savings. The 
next section includes a discussion of the roles and responsibilities within the federal 
GPCP. 


c. Roles and Responsibilities within the Federal Government Purchase 
Card Program 

The participants of the federal GPCP include the agency/organization program 
coordinator (A/OPC), approving official (AO), cardholder (CH), designated billing office 
(DBO), merchant, and card-issuing bank. The purchase card may only be issued to 
civilian or military personnel, so contractors cannot participate in the program. The 
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A/OPC is responsible for managing and overseeing the command’s GPCP, establishing 
internal guidelines, establishing and maintaining accounts, and assisting cardholders. The 
AO is the first point of contact to prevent fraud, waste, and/or abuse of the purchase card. 
The AO supervises the CH and is responsible for reviewing and approving his or her 
purchases. The AO should also resolve any questionable purchases and report any 
misconduct. The CH uses the government purchase card to acquire supplies and services 
within the CH’s authority. The CH is responsible for using the card properly and ethically 
and following all rules and regulations associated with the CH’s delegated purchase 
authority. The DBO oversees invoice processing and payment. The card-issuing bank is 
responsible for issuing purchase cards, processing merchant charges and credits, and 
providing monthly AO and CH account statements (CSA, n.d.-d). The government has 
partnerships with Citibank, JP Morgan Chase, and U.S. Bank (CSA, n.d.-b), and these 
institutions serve as the issuing banks for government agencies. The following section 
discusses the training requirements within the federal CPCP. 

d. Training Requirements within the Federal Government Purchase Card 
Program 

The Office of Management and Budget (0MB, 2009) Circular A-123, Appendix 
B, requires each agency to provide training to CHs and card managers (including A/OPCs 
and AOs). At a minimum, the General Services Administration (CSA) requires online 
training and refresher training offered by the Defense Acquisition University (DAU). 
Credit worthiness assessments used to be mandated for new CHs, but after the passing of 
the 2006 Consolidated Appropriations Act, that requirement was eliminated (Defense 
Procurement and Acquisition Policy [DPAP], 2011; Rendon, 2011). The CSA SmartPay 
Program offers free online CH training to all program participants. The program requires 
participants to complete training prior to appointment to any position within the GPCP. In 
addition, refresher training is required once every three years or more often based on 
agency requirements. Finally, ethics training is also required. Program participants should 
remain familiar with the rules and regulations governing the use of the purchase card 
(CSA, n.d-c). AOs should also familiarize themselves with their agency’s approval and 
tracking systems. 
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As previously mentioned, the GSA SmartPay contract provides purchase cards to 
over 52 federal agencies, one of which is the DOD. The DOD application of the GPCP is 
discussed in the next section. 

2. Department of Defense Application of the Government Purchase 
Card Program 

The DOD GPCP currently uses Citibank to process all types of transactions, 
including those made with the purchase, travel, and fleet card. However, the DOD’s 
independent agencies also use U.S. Bank solely for purchase card transactions. In 
FY2008, the DOD GPCP had 98,839 cardholders, making 8.8 million transactions 
totaling $7.9 billion. As of FY2013, the GSA SmartPay Program reported that the 
DOD purchase card program had approximately 92,647 cardholders making 5.7 million 
transactions valued around $4.9 billion. (GSA, n.d.-c) The DOD GPCP has significantly 
downsized in the last five years, which is expected in the current fiscal environment. 
However, the DOD embraces the purchase card program as it continually seeks methods 
for cost savings and increased accountability. The next section discusses the DOD 
guidance for the GPCP. 

a. Department of Defense Guidance for the Government Purchase Card 
Program 

FAR 13.301 (2014) and Defense Federal Acquisition Regulation Supplement 
(DFARS) 213.270 (2014) and 213.301 (2014) outline the policy for using the GPCP. 
The DOD also provides guidance for its components to help establish the purchase 
card program and implement government- and DOD-mandated controls, rules, and 
regulations. The DOD Purchase Card Program Management Office has oversight of the 
DOD’s GPCP (Office of Financial Management [FMO], n. d.). Each component may 
adopt more stringent controls if necessary or desired, but the rules and regulations apply 
to every component utilizing the GPCP. The process of establishing a purchase card 
program entails determining a need, requesting authority, establishing internal controls, 
and establishing training programs for program officials (DPAP, 2011). The purpose of 
the purchase card is to add value to the business processes in terms of lower costs or 
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increased productivity, but the mandatory outcome is ensuring “management controls 
effectively identify, correct, and minimize fraud, waste, and abuse” (DPAP, 2011, p. 2-2). 

To minimize risks, the management and internal controls should have support 
from higher levels, expect integrity and ethical behavior from participants, engage in 
audits annually, ensure controls are working properly, and provide proper training, both 
initial and refresher (DPAP, 2011). Following the guidelines for maintaining those 
controls will ensure that each component’s program has strong internal controls, capable 
processes, and properly trained personnel (Rendon & Rendon, 2014). 

One of the management controls in place is the Purchase Card Online System. It 
is a DOD-wide system used by GPCP users to improve the management and 
accountability within each component’s GPCP organization (DPAP, 2011). Additionally, 
the DOD has many resources that require management’s compliance with specific rules 
and regulations regarding processes, internal controls, and training. The next section 
discusses the accountability methods within the DOD GPCP. 

b. Department of Defense Accountability Methods within the Government 

Purchase Card Program 

Adequately trained program personnel are vital to maintain accountability. The 
roles and responsibilities previously outlined in the federal GPCP section are applied to 
the DOD as well as to DON and NPS. An AO may not oversee more than seven CHs, and 
an A/OPC may not be responsible for more than 300 accounts (DPAP, 2011). An 
individual CH or AO may be responsible for more than one account. All participants 
involved in a purchase card program must receive training mandated by the GSA 
SmartPay Program. The DOD-mandated purchase card course is titled “DOD 
Government Purchase Card Tutorial” and is hosted by the DAU (DPAP, 2011). The 
DAU offers two online courses, one to study the training material and the other for 
refresher training. Each program participant must produce a certificate of completion to 
the APC after taking the online test. 
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Now that the DOD application of the purchase card has been discussed, the next 
section reviews the purchase card program application of one of DOD’s components, the 
DON. 


3. Department of the Navy Application of the Government Purchase 
Card Program 

The DON GPCP services are provided by a task order issued under the main GSA 
SmartPay2 contract, which expires November 2018 (Naval Supply Systems Command 
[NAVSUP], 2012). The DON instruction applies policy guidance from 10 U.S.C. § 2784 
(2014); 0MB (2009) Circular A-123, Appendix B; and the DOD government charge card 
guidebook (DPAP, 2011). These policies discuss the management of a purchase card 
program, internal controls needed to manage the program, and penalties for violations of 
the GPCP policies. 

The DON Consolidated Card Program Management Division (CCPMD) serves as 
the DON Component program manager, which is organizationally aligned within the 
NAVSUP Corporate Operations division (FMO, n.d.). In 2012, NAVSUP disseminated 
an instruction guide to help establish DON policy for management of the GPCP. In 
FY200I, the Navy had the “second largest purchase program in the DOD, with 
approximately 27,900 cardholders making 2.8 million transactions valued at $1.8 billion” 
{Purchase Cards, 2002, p. 1; GSA SmartPay, n.d.-c). Twelve years later, in FY2013, the 
program had 10,200 cardholder accounts, made 130,000 transactions, and spent 
$128.57 million in purchases (NAVSUP, 2013). Like the DOD program, the DON 
program has also decreased in size, which is not unusual given the current fiscal 
environment. Therefore, with this current fiscal environment, it is crucial to use the 
program efficiently and effectively. The NAVSUP (2012) Instruction 4200.99B outlines 
roles and responsibilities, program management, use of the purchase card, program 
oversight, and disciplinary actions associated with the DON’s application of the GPCP, 
which is discussed next. 
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a. 


Department of the Navy Roles and Responsibilities/Training 


All roles and responsibilities are similar to those given for both federal 
government and DOD programs to include A/OPC, AO, CH, disbursing paying office, 
and card-issuing bank, among others not mentioned. The one addition is that the A/OPC 
also serves as a liaison to the DON CCPMD. In accordance with NAVSUP (2012) 
Instruction 4200.99B, all CHs and AOs must receive purchase card training and ethics 
training. The courses are role- and certification system—specific. Furthermore, the DON 
requires that its program participants take purchase card refresher training every two 
years, which is more stringent than the GSA SmartPay Program requirement of every 
three years, and annual DOD ethics training. The DON CCPMD sponsored regional 
training is one way for program participants to complete the purchase card refresher 
training (NAVSUP, 2013). Training is “key to ensuring that the workforce has the skills 
necessary to achieve organizational goals” {Purchase Cards, 2002, p. 7). The next section 
discusses the DON GPCP management. 

b. Department of the Navy Government Purchase Card Program 
Management 

The DON GPCP management is comprised of personnel requirements, separation 
of duties, span of control, training requirements, and other account information, which 
are reflective of the guidance given for DOD and federal government programs. Purchase 
card program personnel must be civilian government employees or members of the armed 
forces, with exceptions given to some specific positions. Separation of duties aims to 
limit the cross interaction of AOs, CHs, and A/OPCs in the same hierarchy. Training 
requirements, including initial, refresher, and ethics, were previously discussed. Once the 
training is completed and documented, the participant receives authority in a letter of 
delegation with the approved spending limit for the position in which the CH was trained 
(NAVSUP, 2012). Next, the DON use of the government purchase card is discussed. 

c. Department of the Navy Use of the Government Purchase Card 

As previously mentioned, the purchase cards’ authorized use is for paying for 
micro-purchases ($3,000 limit) of supplies, services, or construction for government use 
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to meet the government organizations’ mission. The purchase card is to be used only for 
authorized and approved purchases, not for personal use purchases. In addition, statutory 
requirements must be met in order to use the purchase card as a form of payment. A CH 
must have the authority to purchase goods and services and must follow DOD and DON 
purchasing regulations. Finally, program participants must be in compliance with 
purchasing internal controls when purchasing for the command (NAVSUP, 2012). 

d. Department of the Navy Government Purchase Card Program Oversight 

Program oversight is “required to ensure effectiveness of purchasing and 
management internal controls and includes monthly, quarterly, and semiannual reviews” 
(NAVSUP, 2012, p. 46). This includes assurances from both CHs and AOs regarding 
transaction reviews and account reconciliations. There are procedures that need to be 
followed in order to correctly and thoroughly conduct account and program oversight. 

This section discussed the DON application of the GPCP, including roles and 
responsibilities, program management, use of the purchase card, and the DON GPCP 
oversight. As previously mentioned, the NPS GPCP will be discussed in Chapter III. In 
order for the GPCP to be successful, there must be sufficient corporate governance, 
including auditability and adherence to legislature and current practices, which will be 
discussed next. 

E. CORPORATE GOVERNANCE 

This section of the literature review provides an overview of auditability, 
legislature, and current practices, to include the SOX and the COSO. This section is the 
foundation to understand the internal controls governing purchase card programs. 

1. Auditability 

Auditability is a high-level priority for the DOD because it demonstrates 
responsible stewardship of taxpayers’ money, reduces costs of business operations, and 
complies with congressional direction (Murphy-Sweet, 2013). The government is striving 
to achieve auditability by September 30, 2017, which is the deadline outlined in the 
National Defense Authorization Act (NDAA) for FY2010. To receive a clean audit and 

20 



reach financial auditability by 2017, the DOD and DON implemented an audit readiness 
initiative. The DON’s audit readiness strategy focuses on: 


evaluating business processes to ensure the design and operation 
effectiveness of their internal controls comply with federal financial 
standards; correcting identified internal control deficiencies; ensuring that 
internal controls remain effective through continuous monitoring, testing, 
and auditing; and retaining key supporting documentation demonstrating 
proper execution of business processes for inspection at all levels. (Patton, 

2013, p. 23) 

As reflected in this initiative, the DON’s audit readiness strategy is to focus on 
internal controls. Financial Improvement and Audit Readiness (FIAR) “supports the 
DON’S audit readiness initiative, with the long-term goal of improving financial 
processes and systems throughout the Navy,” (Murphy-Sweet, 2013, para. 2). However, 
financial auditability is not the only goal. Strong and effective internal controls, 
competent people, and capable processes are imperative to auditability and form the basis 
for the auditability triangle, which is illustrated in Figure 1 (Rendon & Rendon, 2014). 
The focus of this research is the internal controls part of the auditability triangle. 



Figure 1. Auditability Triangle (from Rendon & Rendon, 2014) 
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In relationship to internal controls, the SOX and the COSO are addressed next. 


2. Sarbanes-Oxley Act of 2002 

President George H. W. Bush signed the SOX into law in 2002 (Securities and 
Exchange Commission [SEC], 2013). The SOX was enacted to “protect investors by 
improving the accuracy and reliability of corporate disclosures made pursuant to the 
securities laws, and for other purposes” (Sarbanes-Oxley Act, 2002). More specific to 
internal controls. Section 404 addresses management assessment of internal controls. 
Subsections (a) and (b) relate to the rules and evaluation and reporting. Section 404(a) 
mandated that each annual report would require an internal control report including a 
statement of management’s responsibility for the internal control structure and 
procedures as well as an assessment of the internal control structure at year end 
(Sarbanes-Oxley Act, 2002, § 7262(a)). Section 404(b) states that with regard to the 
requirements in Subsection (a), “each public accounting firm that prepares or issues the 
audit report for the issuer shall attest to, and report on, the assessment made by the 
management of the issuer” (2002, § 7262(b)). Although, SOX set standards for public 
companies and public accounting firms to ensure that management creates, maintains, 
and assesses its internal control structure, the internal control requirements are applicable 
to private companies as well as the federal government. An organization that provides 
guidance on internal controls is addressed next. 

3. Committee of Sponsoring Organizations of the Treadway Commission 

The COSO (n.d.-a) was organized in 1985 and consists of five professional 
associations dedicated to providing comprehensive frameworks and guidance on internal 
controls to improve organizational performance and governance. COSO is comprised of 
five professional organizations to include the American Accounting Association (AAA), 
America, Institute of Certified Public Accountants (AICPA), Einancial Executives 
International (EEI), The Institute of Management Accountants (IMA), and the Institute of 
Internal Auditors (IIA; COSO, n.d.-b). COSO’s (n.d.-a) website states that the 
organization’s “goal is to provide thought leadership with three interrelated subjects: 
enterprise risk management (ERM), internal control, and fraud deterrence” (para. 6). The 
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five components of an integrated internal control system are discussed next as outlined by 
the COSO and GAO. 

F. INTERNAL CONTROLS 

Internal controls in the government are a continuous built-in component of 
operations. They are standards in place to ensure, with reasonable assurance, that an 
organization’s objectives are met to improve accountability, and to address areas of risk 
in the organization. The definition of the internal control framework, along with the 
components and principles of internal control are discussed next. 

Internal control is a process designed to provide reasonable assurance that an 
organization will achieve “effectiveness and efficiency of operations, reliability of 
financial reporting, and compliance with applicable laws and regulations” (COSO, 2013; 
GAO, 1999, p. 4). There is a direct relationship between the three categories of 
objectives, which are what an entity strives to achieve, and components, which represent 
what is needed to achieve the objectives” (COSO, 1992, p. 3). 

Snyder, Broome, and Zimmerman (1989) emphasize that “finding the appropriate 
level of internal control is a critical management responsibility” (p. 49). Salerno (2006) 
finds that “appropriate, properly functioning internal controls offer powerful benefits” to 
organizations in many ways (p. 1). Furthermore, Snyder et al. (1989) states that “internal 
control must be used in a consistent manner” throughout the organization (p. 48). 

The five components of an integrated internal control framework are control 
environment, risk assessment, information and communication, control activities, and 
monitoring activities (COSO, 2013). Recently, COSO (2013) released an updated 
Internal Control—Integrated Framework (Framework), which identifies 17 principles 
that represent fundamental concepts within each component. Appendix B reflects the 
integrated internal control components and related principles (Tan, 2013). In addition, the 
Government Accountability Office (GAO, 2013) exposure draft incorporates the new 
COSO guidelines, which are discussed later. Each of the five internal control components 
and 17 principles are discussed in the following sections. 
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1 . 


Control Environment 


The control environment is the first internal control component and is considered 
the foundation of any internal control system as well as the entire organization. 
Management and employees are responsible for establishing and maintaining an 
environment that sets a positive tone toward internal controls (GAO, 2001). There are 
several key factors that support the achievement of this goal, including integrity and 
ethical values, commitment to competence, management’s operating style, and 
organizational structure. Management must establish a tone at the top that values ethical 
behavior and integrity and must ensure that the desired behaviors are communicated 
throughout the organization. Holmes, Langford, Welch, and Welch (2002) propose that 
management must encourage cooperation in achieving a moral purpose through 
ethical behavior. Therefore, a strong, supportive attitude by management toward 
tight internal controls should discourage unethical activity (Holmes et ah, 2002). 
Management should also take timely and appropriate action as soon as there are signs that 
a problem may exist (GAO, 2001). 

The organization must also seek competence for its workforce. This entails 
identifying suitable knowledge and skills needed for various jobs and providing the 
required training (GAO, 1999). Furthermore, management’s philosophy and operating 
style affect the environment as it determines the organization’s attitude toward risk¬ 
taking and performance-based management. These factors can have a great impact on 
internal control. A study by Fleak, Harrison, and Turner (2010) illustrated “how 
weaknesses in the control environment component of the COSO framework can cause or 
exacerbate weaknesses in the control activities, information and communications, and 
monitoring components of the framework” (p. 715). The organization must have clearly 
defined reporting relationships and clearly defined authority and responsibility, and must 
ensure that the organization is appropriately centralized or decentralized (GAO, 2001). 
Additionally, Fleak et al. (2010) illustrate that “internal control is vital for organizations 
of all sizes” (p. 714). Each of the five internal control component sections discusses the 
associated principles outlined in the COSO (2013) Framework. The principles relating to 
control environment are as follows: 
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• Principle 1—The organization demonstrates a commitment to integrity 
and ethical values. 

• Principle 2—The board of directors demonstrates independence from 
management and exercises oversight of the development and performance 
of internal control. 

• Principle 3—Management establishes, with board oversight, structures, 
reporting lines, and appropriate authorities and responsibilities in the 
pursuit of objectives. 

• Principle 4—The organization demonstrates a commitment to attract, 
develop, and retain competent individuals in alignment with objectives. 

• Principle 5—The organization holds individuals accountable for their 
internal control responsibilities in the pursuit of objectives, (p. 6) 

2. Risk Assessment 

Risk assessment is the second internal control component which includes the 
“identification, analysis, and management of risk” (Chang, 2013, p. 16) associated with 
an organization. Risk could inhibit the organization’s efficient and effective ability to 
achieve its objectives. Risk identification includes recognizing significant interactions 
between the organization and external factors as well as internal factors at both the entity 
level and activity level. Other factors identified that may contribute to risks are activities 
related to past failures, the inherent nature of the organization’s mission, and the 
complexity of programs (GAO, 2001). The analysis of risk also includes estimating the 
significance of the risk and assessing the likelihood and frequency of the risk (GAO, 
2001). When analyzing risk, management needs to develop a tolerable level of risk for 
the organization to accept and manage. The management of risk entails deciding which 
internal control activities would best mitigate those risks and helps achieve the internal 
control objectives of efficient and effective operations, reliable financial reporting, and 
compliance with laws and regulations (GAO, 2001). The new COSO (2013) Framework 
principles relating to risk assessment are listed as follows: 

• Principle 6—The organization specifies objectives with sufficient clarity 
to enable the identification and assessment of risks relating to objectives. 

• Principle 7—The organization identifies risks to the achievement of its 
objectives across the entity and analyzes risks as a basis for determining 
how the risks should be managed. 
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• Principle 8—The organization considers the potential for fraud in 
assessing risks to the achievement of objectives. 

• Principle 9—The organization identifies and assesses changes that could 
significantly impact the system of internal control, (p. 7) 

3. Control Activities 

Control activities is the third internal control component and consists of the 
“policies, procedures, techniques, and mechanisms to ensure that management’s 
directives for the organization are carried out” (GAO, 1999, p. 11). The policies, 
procedures, techniques, and mechanisms are also intended to mitigate the risk identified 
in the risk assessment process. Control activities take place at all levels of an 
organization, which include a variety of activities. A manager should consider “whether 
control activities relate to the risk-assessment process and whether they are appropriate to 
ensure the management’s directives are carried out” (GAO, 2001, p. 33). A reviewer 
within the organization determines if the proper control activities are in place, if there are 
a sufficient amount of control procedures, and if they are functioning effectively. It is 
important to establish control activities, but also to understand them, monitor them, and 
ensure they are being applied appropriately and working properly. 

Other common categories of control activities include management of human 
capital, performance measures, and segregation of duties. It is imperative that the 
organization’s mission, expectations, and strategies be clearly communicated to all 
employees so that the organization can manage the workforce to achieve its goals. 
Performance measures should be established throughout the organization and continually 
compared against planned goals to assess progress. Performance measures are also used 
for operational and financial reporting purposes. Segregation of duties can help to reduce 
the risk of fraud, waste, and abuse but solely “relying on segregation of duties where the 
control environment, monitoring, or risk assessment is weak is negligent” (McCuaig & 
Marks, 2005, p. 37). All of these factors impact an organization’s internal control 
activities, “which should be designed accordingly to contribute to the achievement of the 
organization’s missions, goals, and objectives” (GAO, 2001, p. 33). In addition to the 
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control activities discussed, the following are the COSO (2013) Framework principles 
relating to control activities: 

• Principle 10—The organization selects and develops control activities that 
contribute to the mitigation of risks to the achievement of objectives to 
acceptable levels. 

• Principle 11—The organization selects and develops general control 
activities over technology to support the achievement of objectives. 

• Principle 12—The organization deploys control activities through policies 
that establish what is expected and procedures that put policies into action, 
(p. 7) 

4. Information and Communication 

Information and communication is the fourth internal control component. 
Information and communication is the collection of information that is sent to all the 
organization’s stakeholders through the appropriate channels, both internal and external. 
Information needs to be “identified, captured, and distributed to the right people 
in sufficient detail, in the right form, and at the appropriate time to enable them to carry 
out their duties and responsibilities efficiently and effectively” (GAO, 2001, p. 51). 
Managers need two types of information: operating and financial (GAO, 2001). 
Operating information is used to determine compliance with various laws and 
regulations, whereas financial information is used to make operating decisions on a 
daily basis and allocate resources. Information and communication also includes an 
organization’s accounting system. An effective information and communication system 
should allow information to flow up, down, and across the organization (GAO, 1999). 
Williams (2005) contends that “information and communication hold the COSO 
framework together. Collecting, analyzing, and using performance measures for decisions 
are activities that require internal controls to ensure the data used are valid and reliable,” 
(pp. 16-17). 

Management should ensure that internal and external communications are taken 
seriously, that there is a means of communication outside the direct supervisor, and that 
employees know how their roles fit into the overall structure of the organization. The 
organization should “continually improve the usefulness and reliability of its 
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communication of information” (GAO, 2001, p. 55) because it is eonneeted to the 
organization’s overall strategie plan and is eonsequently linked to the aeeomplishment of 
the organization’s objeetives. In addition to the eomponents of information and 
eommunieation diseussed, the COSO (2013) Framework prineiples relating to 
information and communication are as follows: 

• Principle 13—The organization obtains or generates and uses relevant, 
quality information to support the funetioning of internal eontrol. 

• Prineiple 14—The organization internally eommunieates information, 
ineluding objeetives and responsibilities for internal eontrol, neeessary to 
support the functioning of internal control. 

• Principle 15—The organization communicates with external parties 
regarding matters affecting the funetioning of internal control, (p. 7) 

5. Monitoring Activities 

Monitoring activities is the fifth internal eontrol eomponent and is the proeess of 
assessing the quality of an organization’s performanee over time. Williams (2005) 
identifies monitoring as “the proeess of assessing the quality of internal eontrol 
performanee. Monitoring is also the routine review of the effeetiveness of internal 
controls and is perhaps the most important part of the COSO framework,” (p. 17). 
Monitoring is aeeomplished through ongoing monitoring, separate evaluations, or a 
combination of the two. Ongoing monitoring is performed eontinually and is embedded 
in the organization’s normal operations. It includes “regular management and supervisory 
aetivities, eomparisons, reconeiliations, and other aetions people take in performing their 
duties” (GAO, 1999, p. 20). Separate evaluations are a more in-depth review of a single 
internal eontrol proeess at a speeifie point in time. Separate evaluations ean be eondueted 
by an internal individual as a self-assessment or by an external auditor. Any internal 
eontrol deficieneies that are found need to be reported to the person responsible for that 
funetion and his or her supervisor for immediate resolution. 

Audit resolution ineludes findings and reeommendations from formal audits, 
informal reviews, internal separate evaluations, and management studies and assessments 
(GAO, 2001). The organization should be responsive to these reeommendations, find 
ways to strengthen its internal controls, and take appropriate action to follow up and 
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resolve any issues. The COSO Framework (2013) updated this component to 
“Monitoring Activities” in 2013, discussing the same concepts, with the addition of the 
following principles: 

• Principle 16—The organization selects, develops, and performs ongoing 
and/or separate evaluations to ascertain whether the components of 
internal control are present and functioning. 

• Principle 17—The organization evaluates and communicates internal 
control deficiencies in a timely manner to those parties responsible for 
taking corrective action, including senior management and the board of 
directors, as appropriate, (p. 7) 

The previous sections discussed the five internal control components and the 
corresponding principles in accordance with the updated COSO Framework. These five 
components of internal control are important to the purchase card program’s success 
because the absence of effective internal controls can expose the program to 
inefficiencies and vulnerabilities to fraud (Rendon, 2011, p. 11). The next section 
discusses the GAO standards in the GAO 2013 exposure draft as they were developed 
from and relate to the COSO Framework. 

G. INTERNAL CONTROLS IN THE FEDERAL GOVERNMENT 

I. Government Accountability Office Internal Control Framework 

The GAO internal control framework is the COSO Framework applied to the 
federal government. Prior GAO reports were referenced in the previous sections of 
discussion of the internal control components; however, a new set of internal controls 
standards was released by GAO (2013) as an exposure draft of the Standards for Internal 
Control in the Federal Government {Green Book) that implements the new COSO 
integrated internal control framework. GAO is currently in the process of updating the 
Green Book. The GAO exposure draft of the Green Book was open to the public for 
comments through February 18, 2014, so the GAO will be releasing the new standards 
sometime this year and will supersede the 1999 edition of the Green Book. These 
standards provide the framework for establishing and maintaining effective internal 
controls in the federal government (GAO, 2013). 
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The goal is to develop an effective internal control system to achieve an 
organization’s goals; however, it is imperative to understand that the control system can 
only provide reasonable assurance, not absolute assurance, that those objectives will be 
met. The GAO 2013 exposure draft details the implementation of the internal control 
components and principles in a federal government environment similar to the 
implementation discussed in the previous sections. The next section discusses the 
Managers’ Internal Control Program (MICP), which is another tool used to hold federal 
managers accountable for their internal control system. 

2. Managers’ Internal Control Program 

The Federal Managers’ Financial Integrity Act (FMFIA) of 1982 was signed into 
law to ensure that agencies were conducting ongoing evaluations and reporting on the 
adequacy of their internal control systems. The Office of the Under Secretary of Defense 
(Comptroller; OUSD[C]) is responsible for implementing, managing, and monitoring the 
secretary of defense’s program over internal control management (2013a). Although the 
USD(C) is responsible for the program, he/she instructs the director of financial 
improvement and audit readiness (DFIAR) to manage and oversee operations of the 
DOD’s MICP (OUSD[C]/Chief Financial Officer, 2013b). The FMFIA is implemented 
through the DOD MICP (OUSD[C], 2013a). The MICP requires all DOD managers to be 
involved in the program and remain active participants to “review, assess, and report on 
the effectiveness of internal management controls within their command” (OUSD[C], 
2013b, p. 1). The MICP is the Navy’s method for demonstrating compliance with the 
FMFIA, and it is crucial to stay in compliance with this program because the command 
compliance will be reviewed and evaluated during external audits and inspections (NPS, 
2013a). 


The NPS Instruction 5200.IS states, as outlined in Title 31 of the United States 
Code (U.S.C.) § 3512 (2011), the following regarding internal controls: 

requires commands to implement a system of internal controls to provide 
reasonable assurance that programs achieve their intended results; 
resource use is consistent with the Department of the Navy mission; 
programs and resources are protected from waste, fraud, and 
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mismanagement; laws and regulations are followed; and reliable and 
timely information is obtained, maintained, and used for decision-making 
and reporting. (NPS, 2013a, p. 1) 

The implementation of internal control systems were previously required of 
federal managers, but now reporting is an additional obligation and will continue to be a 
requirement to support the auditability of the DOD. The 0MB (2009) Circular A-123 and 
its Appendix B further discuss management’s responsibility for internal controls. 

3. Office of Management and Budget Circular A-123 

0MB (2004) Circular A-123, Management’s Responsibility for Internal Control, 
was previously named Management Accountability and Control. It outlined and defined 
management’s responsibility for internal control in the federal government. This revision 
of the circular was written in 2004 after the new requirements for publicly traded 
companies were established in the SOX; however, the circular was not implemented until 
FY2006. Agencies were given time to prepare for its implementation, and in the interim 
followed the previous version of Circular A-123 (0MB, 2004). The revised 0MB 
Circular A-123 was to supersede all previous versions once implemented. At the time, 
this circular and the statute it implemented, FMFIA of 1982, were the core federal 
requirements to improve internal controls (0MB, 2004). The content of the circular was 
meant to strengthen the requirements for assessment of internal controls and emphasize 
the connection between internal control assessments and internal control-related activities 
(0MB, 2004). 

Appendix B of Circular A-123 was “Improving the Management of Government 
Charge Card Programs” (0MB, 2004). The revised Appendix B outlined policies and 
procedures regarding how to maintain internal controls in government charge card 
programs (0MB, 2009). It established minimum requirements and identified best 
practices from all issuing agencies, such as the 0MB, GSA, Department of Treasury, and 
others. The goal of the guidance was to improve the GPCP and maximize the benefits to 
the federal government. Benefits included reduction of administrative costs, decrease in 
transaction time and costs, mitigation of risks, improvement of financial and 
administrative processes, and policy compliance monitoring (0MB, 2009). The 
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information contained in the 0MB Circular A-123 Appendix B must be distributed to all 
employees in the purchase card program and “included in internal agency procedures and 
training materials” (0MB, 2009, p. 3). 

H. SUMMARY 

This literature review presented a background of the research with an overview of 
the evolving role of the purchasing function. It also presented the industry purchase card 
program and its associated roles and responsibilities. In addition, the GPCP and its 
application in the federal government, the DOD, and the DON were discussed. Corporate 
governance, which included auditability, the SOX and COSO were addressed. 
Furthermore, the integrated internal control components were discussed and as well as 
internal controls in the federal government. 

The next chapter introduces the Naval Postgraduate School (NPS) and its use of 
the GPCP. NPS is the focal organization for this research on the analysis of perceptions 
of internal controls in the GPCP. 
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III. NAVAL POSTGRADUATE SCHOOL 


A. INTRODUCTION 

The Naval Postgraduate School (NPS) is located in Monterey, CA. The school 
provides graduate education to U.S. and foreign military officers and government 
employees. NPS’s mission is to “provide relevant and unique advanced education and 
research programs” (CNO, 2012, p. 3), and through this mission, NPS fulfills the 
graduate education needs of the Department of Defense (DOD). The institution is 
comprised of four schools, several departments, and a number of centers, all of which 
have staff, faculty, and students with purchasing requirements who are working to 
accomplish their specific mission, which supports NPS’s mission. 

The staff at the school supports the operations of NPS in functional areas 
including, but not limited to, contracting and purchasing. The Department of Contracting 
and Logistics governs the contracting and purchasing functions for all of NPS, and the 
staff in the department supports the purchasing requirements for NPS schools, 
departments, and centers. This chapter will provide a discussion of the Contracting and 
Logistics Department and NPS’s purchasing organizational structure. Finally, the GPCP 
at NPS is discussed, including the span of control, training requirements, and 
administrative actions for noncompliance. 

B. CONTRACTING AND LOGISTICS MANAGEMENT 

A recently released NPS instruction states, “Under the direction of the Director of 
Contracting and Logistics Management, the Contracting and Logistics Management 
organization provides procurement and contracting support for the acquisition of supplies 
and services for the Naval Postgraduate School” (NPS, 2013b, p. 13). The organization 
was recently restructured to enhance efficiency and effectiveness within the department, 
as well as provide clarity for the employees and end users. As previously mentioned, all 
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staff, faculty, and students have purchasing requirements in order to complete their 
specific mission, which supports NFS’s mission. To accomplish the mission of NFS, the 
staff involved in the purchasing function must be properly equipped with the right tools. 
The purchasing organizational structure, which differentiates the two types of purchasing 
support provided at NFS, is discussed next. 

C. PURCHASING ORGANIZATIONAL STRUCTURE AT THE NAVAL 

POSTGRADUATE SCHOOL 

Purchasing in support of NPS is organized into a hybrid structure, which is an 
organizational design that provides flexibility to meet changing business conditions 
(Monzcka et al., 2011). Organizational design refers to the process of selecting a 
“structured and formal system” that incorporates communication, control, authority, and 
other responsibilities needed to accomplish the organization’s goals (Monzcka et al., 
2011). Monzcka et al. (2011) contended that “one of the most critical aspects of 
organizational design is the decision to centralize or decentralize purchasing authority” 
(p. 158). The purchasing authority at NPS is a hybrid because it has both centralized 
and decentralized aspects. The purchasing agents who are mostly responsible for large 
orders ranging from $3,000-$150,000 are centralized, whereas the purchase cardholders 
(CHs) who are responsible for the small orders under the micro-purchase threshold of 
$3,000 are decentralized. 

In FY2012, the NPS Government Purchase Card Program (GPCP) was 
responsible for making approximately 21,000 transactions totaling approximately 
$24.2 mi llion (M. Morales, personal communication, July 24, 2013). Both purchasing 
agents and government purchase CHs report to the director of contracting and logistics 
management (NPS, 2013b). The GPCP at NPS is discussed next, which includes span of 
control, training requirements, and administrative actions for noncompliance. 
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D. NAVAL POSTGRADUATE SCHOOL GOVERNMENT PURCHASE 

CARD PROGRAM 

The Department of Contracting and Logistics Management owns the NPS GPCP, 
but the agency program coordinator (APC) has overall responsibility of the program to 
ensure its integrity and success. The APC’s responsibility is to ensure all program 
participants, specifically approving officials (AOs) and CHs, are properly equipped with 
the knowledge, skills, and abilities to accomplish their purchasing requirements. The 
APC is also responsible for tracking training completion, ensuring that proper oversight 
and management controls are in place and working, and conducting compliance reports. 
The APC is tasked with making sure that AOs and CHs complete the mandatory training 
requirements (including refresher training when necessary), remain fa mi liar with all 
policies and procedures associated with the program, and are aware of the internal 
controls in place. The following sections will discuss span of control, training 
requirements, and administrative actions for noncompliance regarding the GPCP at NPS. 

1. Span of Control 

The NPS GPCP is composed of a total of 24 AOs and 32 CHs dispersed 
throughout the campus to serve their departments’ customers. The responsibilities of an 
AO and a CH are collateral duties to be performed in conjunction with primary duties. 
Given the ratio of CHs to AOs at NPS, an AO is responsible for overseeing no more than 
two CHs, which complies with current DON regulation on span of control, which 
specifies that an AO may not oversee more than seven CHs (NAVSUP, 2012). In 
addition, the DON instruction states that an APC may not oversee more than 300 AOs, so 
NPS is also in compliance with that requirement. 

2. Training Requirements 

NPS (2012) Instruction 4410. IC outlines the training requirements for its AOs 
and CHs. After the passing of the 2006 Consolidated Appropriations Act, the requirement 
for credit worthiness assessments for new CHs was eliminated (DPAP, 2011; Rendon, 
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2011). However, agency officials and APCs are allowed to continue implementing this 
requirement at their discretion (Rendon, 2011). Credit worthiness assessments are not 
required for new CHs at NPS. 

Required training for AOs and CHs at NPS align with the requirements for the 
DON. Those requirements include a course from the Defense Acquisition University 
(DAU), online DON purchase card training for their specific role, and DOD ethics 
training (NAVSUP, 2012). In addition, purchase card refresher training is required every 
two years, which can be completed through the Consolidated Card Program Management 
Division (CCPMD) sponsored regional training, specific DAU courses, or online DON 
purchase card training. Furthermore, DOD annual ethics training is required as well. 
Initial training with Citibank is required, and NPS also requires that all purchase card 
personnel attend local annual procedures training. Lastly, all new cardholders must 
complete a class on using Funds Administration and Standardized Document Automation 
(FASTDATA) and the Kuali Financial System (KFS). The FASTDATA is used as NFS’s 
financial management tool to input purchase card transactions into the Standard 
Accounting and Reporting System (STARS). The KFS is used as the business 
management system for NPS (NPS, 2013b). 

3. Administrative Actions for Noncompliance 

If the AO and/or CH do not comply with appropriate regulations and policies, 
administrative actions will be taken. NPS (2008) Instruction 4200.1A, titled Navy 
Purchase Card Rule Violations and Applicable Administrative Actions, identifies two 
types of card violations and associated administrative actions. The APC is responsible for 
informing, investigating, and confirming all violations to the appropriate leadership 
(NPS, 2008). Category “A” violations occur when AOs and CHs fail to adhere to proper 
record keeping and training requirements, whereas Category “B” violations occur when 
AOs and CHs violate purchasing rules and regulations. The administrative actions for a 
Category A violation depend on whether it is the first, second, or third violation. The first 
violation requires corrective action, the second violation may result in a suspended 
account and required remedial training, and the third violation results in a cancelled 
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account for the CH and a suspended account for the AO. Based on the results of a 
Category B violation, the comptroller may immediately cancel the account and provide 
guidance and additional training (NFS, 2008). 

E. SUMMARY 

This chapter presented a brief overview of NFS, including its mission and 
purchasing requirements. In addition, a discussion of the Contracting and Logistics 
Department and its purchasing organizational structure was provided. Finally, the GFCF 
at NFS was discussed including the span of control, training requirements, and 
administrative actions for noncompliance. The next chapter presents the methodology of 
this research. 
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IV. METHODOLOGY 


A. INTRODUCTION 

This chapter provides an outline of the methodology used to conduct this research 
study. The method used to develop the survey, the sources used to develop the individual 
questions used in the survey instrument, and the deployment of the survey are diseussed. 
The proeess used to analyze the data is also addressed. 

B. SURVEY DEVELOPMENT 

The survey was developed using two sourees. The first souree was a previously 
validated survey developed by the New York State Internal Control Assoeiation 
(NYICA; 2011). Questions from the survey that were most pertinent to the five 
eomponents of internal eontrol were utilized. The seeond souree was questions developed 
by the researeh team. Demographic questions and additional questions based on the 
information provided in the literature review conducted on the government purehase eard 
program were developed. The survey consisted of 69 Likert-based survey items with 
seven options ranging from “Strongly Agree” to “Strongly Disagree.” The participants 
also had the option to ehoose “I don’t know” or “I prefer not to answer,” whieh were part 
of the seven options. 

The survey was developed to analyze the approving officials’ (AOs) and 
cardholders’ (CHs) pereeptions of internal controls within the purchase card program at 
the Naval Postgraduate Sehool (NPS). First, the demographie questions addressed the 
partieipants’ employment eategory, position in the Government Purehase Card Program 
(GPCP), time in their position, numbers of schools/departments/people they support or 
oversee, and pereentage of their working hours that were spent eondueting GPCP 
collateral duties. Second, the survey foeused on questions relating to the five components 
of the Committee of Sponsoring Organization of the Treadway Commission (COSO) 
integrated internal eontrol framework to inelude control environment, risk assessment, 
control activities, information and communication, and monitoring activities. 
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Control environment survey items relate to ethical standards, trust, management’s 
conduct, training requirements and knowledge, and overall work environment. Risk 
assessment survey items relate to accountability, sufficient resources, and factors 
that may affect the employee’s work environment and ability to complete their duties. 
Control activities survey items relate to current policies and procedures, the process for 
reporting, the knowledge of consequences, supervision, and computer systems’ security. 
Information and communication survey items relate to the interaction between 
management and work units, knowledge of expected behavior and performance, channels 
of communication, and the process of sharing information to reach their units’ objectives. 
Monitoring activities survey items relate to output measurability and performance 
reviews, reviews of policies and practices, and program oversight. 

Finally, there were three open-ended questions at the end of the survey. The open- 
ended questions asked the participant to list or describe the top five critical success 
factors needed for an organization to achieve its mission for the GPCP, to list or describe 
the top five issues that could hinder the success of the GPCP, and to explain why he or 
she disagreed or strongly disagreed with any of the survey questions. 

C. SURVEY DEPLOYMENT 

The survey was deployed to AOs and CHs in the purchase card program at NPS. 
Each participant was sent an e-mail with a link to the web-based survey on LimeSurvey. 
The survey was voluntary and anonymous. No personally identifiable information (PII) 
was collected. All participants were given permission to complete the survey at their 
workstation and during work hours. The survey was available for three weeks. Once the 
survey was closed, the researchers collected the responses from LimeSurvey to conduct 
an analysis of the data. The population consisted of 56 potential participants, 13 of whom 
submitted a complete survey; therefore, the survey participation rate was 23%. 

D. PROCESS USED TO ANALYZE DATA 

Due to the low participation rate, the data was analyzed using only descriptive 

statistics. The collected data was analyzed using IBM SPSS Statistics Version 19. The 

responses were coded to assist with the analysis. Descriptive statistics “involves 
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arranging, summarizing, and presenting a set of data in such a way that useful 
information is produced. Its methods make use of graphical techniques and numerical 
descriptive measures (such as averages) to summarize and present the data” (Keller, 
2009, p. 12). The survey did not ask knowledge questions because the research study was 
not assessing participants’ knowledge of internal controls; it was simply identifying their 
perceptions of compliance to internal controls within the NFS GPCP. The data gathered 
from the results were analyzed in several different ways as discussed later; however, the 
basis of analysis was the mean, or average, response. 

Initially, the overall frequency of the demographics questions is identified. Then, 
the mean for each of the five internal control components are calculated and presented. 
The mean is the average, and the frequency is the rate of occurrence. In addition, the five 
internal control components are analyzed by the participants’ position in the government, 
AO or CH, which are used to identify any differences in perceptions of internal controls 
between AOs and CHs. Additional observations based other analysis are discussed. The 
frequency of “I don’t know” responses is also discussed. Finally, any potential 
implications of the survey findings on internal controls may have on auditability are 
discussed. 

E. SUMMARY 

This chapter provided an outline of the methodology used to conduct this research 
study. The method used to develop the survey, the sources used to develop the individual 
questions used in the survey instrument, and the deployment of the survey were 
discussed. The process used to analyze the data was also addressed. The next chapter 
discusses the results of the research, provides an analysis of the results, identifies any 
implications of the research results, and provides recommendations based on the data 
analysis. 
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V. RESULTS, ANALYSIS, IMPLICATIONS, AND 
RECOMMENDATIONS 


A. INTRODUCTION 

In this chapter, the results of the online survey eolleeted from LimeSurvey are 
presented, whieh inelude survey items pertaining to demographies and the five 
components of internal control: control environment, risk assessment, control activities, 
information and communication, and monitoring activities. The overall population’s 
mean of the Likert-based responses in addition to the frequency of the demographics 
survey items are identified. The mean for eaeh of the five internal eontrol eomponents are 
also calculated and presented. The mean and frequency of responses from the approving 
offieials (AOs) and eardholders (CHs) are eompared and analyzed to identify any 
differenees in pereeptions of internal eontrols between AOs and CHs. Additional analysis 
based on the results is diseussed. The open-ended questions were not analyzed as part of 
this researeh study. Furthermore, any potential implieations of the survey findings on 
internal eontrols, or lack thereof, on auditability within the Government Purchase Card 
Program (GPCP) at the Naval Postgraduate Sehool (NPS) are addressed. Finally, 
recommendations based on the data analysis are presented. 

B. ANALYSIS OF DEMOGRAPHIC QUESTIONS 

I. Survey Response 

The survey was deployed on Tuesday, January 14, 2014 and was open for three 
weeks until it elosed on Tuesday, February 4, 2014. During the time that the survey was 
available, 13 participants responded. The web-based survey link was sent to 56 people, so 
the response rate was 23%. All participants were federal civilian employees, and out of 
the 13 responses, six were AOs and seven were CHs. The survey consisted of Likert- 
based survey items with seven options ranging from “Strongly Agree” to “Strongly 
Disagree.” The partieipants also had the option to ehoose “I don’t know” or “I prefer not 
to answer.” Of the total survey items, there were eight demographies survey items, 
ineluding employment eategory and position, whieh are diseussed next. 
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2. Responses by Experience 

The response options were divided into six categories based on years of 
experience in the role as AO or CH. The options were 0-1, 2-3, 4-5, 6-7, 8-9, and over 
10 years. Figure 2 displays the responses. Based on the responses, approximately 8% of 
participants indicated that they had less than one year of experience, while 38% of the 
participants had four to five years of experience, and 23% had over 10 years of 
experience. 


■ 0-1 years 

■ 2-3 years 

■ 4-5 years 

■ 6-7 years 

■ over 10 \'ears 


Figure 2. Number of Responses by Years of Experience as an AO or CH 

3. Responses by Number of Schools 

The response options were divided into four categories based on the number 
of schools each participant was responsible for in the GPCP. The options were 1, 2, 3, or 
4 schools. Figure 3 displays the responses. Out of the four possible options, participants 
chose only two of the available options. Based on the responses, approximately 77% of 
the participants were responsible for one school in the GPCP, while the remaining 
23% were responsible for four schools in the GPCP. 
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Figure 3. Number of Responses to Number of Schools Supported 


4. Responses by Number of Departments 

The response options were divided into four categories based on how many 
departments each participant was responsible for in the GPCP. The options were 0-3, 
4-6, 7-10, or more than 10 departments. Figure 4 displays the responses. The data shows 
that 54% of the participants were responsible for 0-3 departments, and only 15% were 
responsible for more than 10 departments. The remaining 31% were responsible for 
4-10 departments; one for 4-6 departments (8%) and three for 7-10 departments (23%). 
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Figure 4. Number of Responses to Number of Departments Supported 


5. Responses by Number of People AO Oversees 

The AOs were asked how many people they oversee in the GPCP. The options 
were 0-5, 6-10, 11-15, 16-20, or more than 20 people. Figure 5 displays the responses. 
Based on the responses, 83% of the AOs oversaw 0-5 people and 17% oversaw 
6-10 people. It is important to note that the numbers are consistent with the regulation 
that an AO may oversee no more than seven CHs. 
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Number of People AOs 0\ ersee 


Figure 5. Number of Responses by Number of People AOs Oversee 

6. Responses by Number of People CH Supports 

The CHs were asked how many people they support in the GPCP. The options 
were 0-5, 6-10, 11-15, 16-20, or more than 20 people. Figure 6 displays the responses. 
Based on the responses, 29% of CHs responded that they supported 0-5 people and 
71% of CHs responded that they supported more than 20 people. The number of people 
each CH supported may be related to the size of the school(s) and department(s) they 
each supported. 
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Figure 6. Number of Responses by Number of People CHs Support 

7. Responses by Percentage of Time Spent on Collateral Duty 

The participants were also questioned regarding the percentage of their working 
hours that were spent conducting GPCP collateral duty assignments. The options were 
100%, 75%, 50%, 25%, or less than 25%. Figure 7 displays the responses. Based on the 
responses, approximately 46% of participants—five AOs and one CH—responded that 
they spent less than 25% of working hours conducting GPCP collateral duties and 38% of 
participants, all of whom were CHs, spent more than 75% of their working hours 
conducting GPCP collateral duties. Only one responded that 100% of their working hours 
were spent conducting GPCP collateral duty assignments, which implies that this was not 
a collateral duty for this one person; it was a full-time duty. 
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Figure 7. Number of Responses by Collateral Duty as Percentage 

of Working Hours 

In this section, overall frequency data for the demographics was presented. The 
analysis of the data for the five internal control components is presented next. 

C. ANALYSIS OF INTERNAL CONTROL QUESTIONS 

The survey consisted of 69 survey items relating to Committee of Sponsoring 
Organization of the Treadway Commission’s (COSO) five internal control components. 
The mean calculations did not include one survey item from the risk assessment 
component that only pertained to AOs; therefore, 68 survey items were used in the 
analysis. During analysis of the individual survey items within each component, “I don’t 
know” responses were coded as 0 (zero value). The “I don’t know” responses were not 
included in the mean calculations. They were converted to blanks in the Excel 
spreadsheet and were identified as missing responses in SPSS. The open-ended questions 
were not analyzed as part of this research. 

Figure 8 displays the overall mean for each internal control component. Based on 
the survey results, risk assessment scored the lowest with a mean of 3.2, meaning this 
component had more “disagree,” or “neither agree nor disagree,” responses to the survey 
items pertaining to risk assessment. Control activities scored the highest with a mean of 
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3.78, meaning this component had more “agree,” or “neither agree nor disagree” 
responses to the survey items pertaining to control activities. Thus, the risk assessment 
controls were perceived to be the weakest of the five internal control components, 
whereas the control activities were perceived to be the strongest internal control 
component within the GPCP at NPS. 



Control Risk Cortrol Information & Monitoring 

Emironment Assessment ActiWties Communication Actixities 

Internal Control Component 


Figure 8. Average Response by Internal Control Component 

1. Control Environment 

As shown in Figure 8, the overall mean for the control environment component 
was 3.57, second highest after control activities. Comparing the two groups. Figure 9 
shows a mean of 3.69 for AOs and 3.47 for CHs. 
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Figure 9. Average Response for Control Environment Component 


2. Risk Assessment 

The lowest overall mean of the five internal control components was risk 
assessment, with a mean of 3.2 as shown in Figure 8, and that finding is corroborated by 
the data in Figure 10. The mean responses of AOs and CHs were compared, and the data 
indicates that CHs disagree with more components of risk assessment than AOs. The 
AOs’ mean response for survey items pertaining to risk assessment was 3.56, whereas the 
CHs’ mean response was 2.94. 
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Figure 10. Average Response for Risk Assessment Component 


3. Control Activities 

The highest overall mean of the internal control components was for control 
activities, with a mean of 3.78 as shown in Figure 8, and that finding is supported by the 
data in Figure 11. The AOs’ mean response to the survey items pertaining to control 
activities was 3.85 and the CHs’ was 3.7. 



Appro\-ing Officials C ardholders 

Figure 11. Average Response for Control Activities Component 
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4. 


Information and Communication 


As shown in Figure 8, the internal control component information and 
communication had the second lowest overall mean with 3.45. Figure 12 shows the 
comparison of the AOs’ mean response within this component of 3.53 and the CHs’ 
mean of 3.36. 


4 

3.5 
3 

2.5 

3 2 
5 

1.5 

1 

0.5 
0 

Figure 12. Average Response for Information and Communication Component 

5. Monitoring Activities 

The monitoring activities component had an overall mean of 3.5 as shown in 
Figure 8. Figure 13 compares the AOs’ overall mean of 3.59 and the CHs’ of 3.45. 
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Figure 13. Average Response for Monitoring Activities Component 


Table 2 presents the number of survey items within each of the five internal 
control components and the mean response from AOs and CHs for each component. The 
“I don’t know” responses were not calculated in the mean. 
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Internal Control 
Component 

Number of Survey 
Items 

Mean of 
Approving 
Officials 

Mean of 
Cardholders 

Control Environment 

17 

3.69 

3.47 

Risk Assessment 

8 

3.56 

2.94 

Control Activities 

14 

3.85 

3.70 

Information and 
Communication 

16 

3.53 

3.36 

Monitoring Activities 

14 

3.59 

3.45 

Total 

68 




Table 2. Number of Survey Items and Mean Responses From AOs 
and CHs for the Five Internal Control Components 


The mean was used to analyze the data for each of the five internal control 
components separately, which produced one mean per internal control component, as 
shown in Figure 8. In addition, the mean of the responses from AOs and CHs, in relation 
to each survey item within each component, was compared to identify any differences in 
overall responses between AOs and CHs. 

D. ADDITIONAL ANALYSIS 

From additional data analysis, survey items that were deemed significant or 
important to discuss were considered noteworthy. In this section, the frequency and type 
of survey items to which participants responded “I don’t know” are identified and 
discussed. In addition, survey items are addressed by individual survey item as well as by 
the differences in means between AOs and CHs based on newly created criteria, which 
are explained within each section of analysis. 
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1. Analysis of “I Don’t Know” Responses 

This section provides analysis of the “I don’t know” responses. The “I don’t 
know” responses indicated possible uncertainty regarding the specific survey item, which 
can have important implications. During analysis of the individual survey items within 
each component, “I don’t know” responses were coded as 0 (zero value). The “I don’t 
know” responses were not included in the mean calculations. They were converted to 
blanks in the Excel spreadsheet and were identified as missing responses in SPSS. 
Overall, there were 26 “I don’t know” responses, which will now be referred to as 
missing responses. 

There were two missing responses within the control environment component. 
Those survey items related to the discussion of performance standards and personal 
conduct. The control environment component had the least uncertainty among the 
participants, with only two missing responses. Within the risk assessment component, 
there were four missing responses. Those survey items pertained to pressure to get the job 
done and staff accountability. An analysis of the control activities component revealed 
that there were also four missing responses. Those survey items pertained to the span of 
control for the oversight of the GPCP, appropriate consequences to those who break laws 
and rules, and knowledge of measures in place to block certain vendors. 

The information and communication component had nine missing responses. This 
component had the most uncertainty among the participants. These survey items 
addressed knowledge of employee protection for reporting impropriety, consequences of 
illegal/improper use of the purchase card, and information systems’ provision of reports 
to management on a unit’s performance related to its objectives. One possible implication 
of the relatively high number of “I don’t know” responses is that important information 
may not be disseminated and; therefore, the employees may not be aware of existing 
regulations. The monitoring activities component had seven missing responses. This 
component had the second highest level of uncertainty among the participants. These 
survey items were regarding timely follow-up to feedback and complaints, policy review 
to ensure compliance, GPCP monitoring to ensure correct span of control, and systems’ 

ability to prevent or detect missing or incorrect information. The overall implications of 
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possible uncertainty in the area of information and communication are addressed later. 
The next section provides an analysis of Agree and Disagree categories by internal 
control component. 

2. Analysis of Agree and Disagree Categories by Internal Control 
Component 

This section discusses the additional analysis on the “agree and strongly agree” 
and the “disagree and strongly disagree” responses, based on newly created categories 
and criteria. To determine whether responses to a question was interesting to note for 
individual survey items, using SPSS, the valid percent was calculated for each of the five 
response options: “strongly agree,” “agree,” “neither agree nor disagree,” “disagree,” and 
“strongly disagree.” Those who responded “I don’t know” were not included in the valid 
percent calculation. The valid percent calculation was based on only the actual responses 
for each particular survey item. 

The valid percents for “strongly agree” and “agree” were combined to form 
category “Agree”, and the valid percents for “strongly disagree” and “disagree” were also 
combined to form category “Disagree.” The total percentages for category Agree and for 
category Disagree were then separated into three sub-categories: (1) greater than 50% but 
less than 75%, (2) greater than 75% but less than 100%, and (3) 100%. However, only the 
survey items in which 100% of the participants agreed or more than 50% of the 
participants disagreed were further analyzed. The response for “neither agree nor 
disagree” was not included in these particular calculations. 

The survey items that fell into the 100% agree sub-category and into the greater 
than 50% disagree sub-category are identified and explained in each internal control 
component section. All findings were practically significant, meaning it has valuable 
implications to the management of the GPCP. 

a. Control Environment 

There were no survey items that fell into the 100% agree sub-category in the 

control environment component. There were, however, three survey items that fell into 

the greater than 50% disagree sub-category. More than 50% of the participants responded 
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that an atmosphere of mutual trust and open communication between management and 
employees had not been established within the organization. Also, more than 50% of the 
participants disagreed on whether their work units were cross-trained so that they could 
fill in for each other when necessary. Furthermore, more than 50% participants responded 
that personnel turnover has impacted their units’ abilities to effectively perform its 
functions. 

b. Risk Assessment 

The one risk assessment survey item that 100% of the participants agreed was that 
AOs hold their staff accountable; however, only three out of six AOs responded to this 
question. The missing three may have answered “not applicable”; however, that is not 
consistent with the demographics question asking AOs to identify how many people they 
oversaw. There were no survey items that fell into the greater than 50% disagree sub¬ 
category in the risk assessment component. 

c. Control Activities 

Two survey items within control activities fell into the 100% agree sub-category. 
One hundred percent of participants agreed that they were discouraged from sharing their 
computer passwords with others. In addition, 100% of the participants agreed that their 
organization effectively established processes so that no single person in the organization 
buys, receives, and certifies funds within the purchase card program. There were no 
survey items that fell into the greater than 50% disagree sub-category within the control 
activities component. 

d. Information and Communication 

There was one survey item that fell into the 100% agree sub-category in the 
information and communications component. One hundred percent of the participants 
agreed that they knew where to report employee misconduct. There was no survey item 
that fell within the greater than 50% disagree sub-category within this internal control 
component. 
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e. Monitoring Activities 

There was only one question that fell into the 100% agree sub-category in the 
monitoring activities component, which was that 100% of participants knew what action 
to take if they became aware of unethical or fraudulent activity. Additionally, more than 
50% of participants did not agree that internal and/or external feedback and complaints 
were followed up on in a timely and effective manner. The next section provides an 
analysis of the differences in means between AOs and CHs. 

3. Analysis of Differences in Means 

This section discusses additional analysis on the differences in means between 
AOs and CHs, based on a newly created category. From the data analysis, survey items 
that were deemed significant or important to discuss were considered noteworthy. During 
analysis of the individual survey items within each component, “I don’t know” responses 
were coded as 0 (zero value). The “I don’t know” responses were not included in the 
mean calculations. To determine if the difference in means by survey item between AOs 
and CHs was noteworthy, the difference in means between AOs and CHs was calculated 
using SPSS. If the difference was found to be greater than 90%, the survey item was 
deemed noteworthy. However; all findings were practically significant, meaning they 
have valuable implications to the management of the GPCP. The eight survey items with 
a noteworthy difference in means between AOs and CHs are identified below. Of the 
eight noteworthy differences, seven survey items indicated that CHs responded 
significantly lower than AOs, whereas only one question indicated that AOs responded 
significantly lower than CHs. 

There were three noteworthy differences in the risk assessment component where 
CHs responded significantly lower than AOs. CHs responded that they felt unreasonable 
pressure to get the job done, their departments did not identify barriers or resolve issues 
that could impact achievement objectives, and they did not have enough time in the day 
to get the job done, including their collateral duties. The third survey item indicates that 
CHs perceive that they do not have enough time to perform their GPCP collateral duties 
along with their regular job duties. 


59 



There were also three noteworthy differences within the information and 
communication component where CHs responded significantly lower than AOs. CHs 
disagreed that their information systems provided management with timely reports on 
their units’ performance relative to objectives. The CHs also disagreed that the 
interaction between management and their work units enabled them to perform their jobs 
effectively. Furthermore, the CHs disagreed that management was aware of their business 
units’ actual performance. 

Finally, there were two noteworthy differences within the monitoring activities 
component where AOs responded significantly lower than CHs, and one item where CHs 
responded significantly lower than AOs. The AOs did not agree that computerized data 
entry systems within their units effectively prevented or detected missing information and 
CHs disagreed that, in their absences, a qualified CH was available as a backup if needed. 
There were no noteworthy differences in means between AOs and CHs in the control 
environment or the control activities survey items. 

This section presented an analysis of “I don’t know” responses. An analysis of the 
Agree and Disagree categories by the five internal control components and an additional 
analysis of the difference in means between AOs and CHs were presented. The next 
section provides implications of findings related to the research questions. 

E. IMPLICATIONS OF FINDINGS RELATED TO RESEARCH 

QUESTIONS 

The purpose of the research was to answer the questions below through the 
development and deployment of the online survey as well as the analysis of the results. 

• What are the differences in perceptions of internal controls between the 
approving officials and cardholders in the Government Purchase Card 
Program at the Naval Postgraduate School? 

Based on the analysis of the results, eight significant differences in perceptions 
between AOs and CHs were identified in three of the five internal control components: 
risk assessment, information and communication, and monitoring activities. 

Within the risk assessment component, the following significant differences 
between AOs and CHs were identified: 
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1. CHs responded that they did not have enough time in a workday to 
complete their duties, including collateral duties, whereas AOs did not 
appear to have this perception. 

2. CHs felt unreasonable pressure to get the work done, whereas AOs did not 
appear to have this perception. 

3. CHs responded that their departments did not identify barriers or resolve 
issues that could impact achievement of department objectives, whereas 
AOs did not appear to have this perception. 

Within the information and communication component, the following significant 
differences between AOs and CHs were identified: 

4. CHs responded that management did not receive timely reports on their 
units’ performance relative to their objectives, whereas AOs did not 
appear to have this perception. 

5. CHs responded that interaction between management and their units did 
not enable them to do their jobs effectively, whereas AOs did not appear 
to have this perception. 

6. CHs responded that management was not informed or aware of their units’ 
actual performance, which differs significantly from the responses from 
AOs. 

Within the monitoring activities component, the following significant differences 
between AOs and CHs were identified: 

7. AOs’ responded that their units’ computerized systems were not able to 
effectively prevent or detect missing and incorrect information, which 
differed from CHs perception. 

8. CHs did not agree that there was a qualified CH available as a backup to 
meet their end users’ needs in their absences. AOs, on the other hand, 
strongly agreed that there was a qualified AO available as a backup in 
their absences. 

Overall, the means for each internal control component for AOs were consistently 
higher than for CHs. This finding implies that AOs generally perceive the strength of the 
GPCP’s internal controls to be stronger than the CHs perceive them. 

• What are the implications to auditability from the differences in 
perceptions of internal control between approving officials and 
cardholders within the Government Purchase Card Program at the Naval 
Postgraduate School? 

Both strong and weak internal controls have implications on auditability. The 
analysis identified potential implications of internal controls, or lack thereof, on 
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auditability within the GPCP at NPS. An implication of the differences in perceptions in 
the risk assessment component is that GPCP participants may be rushed to complete the 
job in order to meet their organization’s goals. This could lead to making mistakes in the 
process, increasing the vulnerability for possible fraud, waste, and abuse, and hindering 
the organization’s auditability (GAO, 2008). An implication of the differences in 
perceptions in the information and communication component is that progress and 
objectives are possibly not being measured, and proper oversight may not be present. 
CHs and management may not be communicating effectively to achieve the best results 
for the organization. If management is unaware of a unit’s performance, it may hinder 
them from making informed decisions for the organization. 

Another implication of the differences in perceptions in the information and 
communication component is that participants appear to know where to report suspected 
wrong-doing or improprieties and appear to be aware of the potential consequences. 
However, the results indicate that majority of them may not know if management ensures 
appropriate actions after the initial reporting. If management does not take proper action 
against wrong-doing and improprieties, CHs and AOs may not take management or the 
potential consequences seriously. An implication of the differences in perceptions in the 
monitoring activities component is from the difference of perceptions regarding 
reliability of the organization’s computer systems. If the organization cannot rely on the 
unit’s computerized system, the employee must have comprehensive knowledge of the 
system to prevent errors themselves, and if they rely on the computer system which may 
be unreliable, it may hinder the organization from becoming auditable. Finally, if 
qualified people are not available to act as backups, the organization would not be able to 
support its end users. The absence of effective internal controls can expose the purchase 
card program to inefficiencies and vulnerabilities to fraud, which would impact 
auditability in the organization. The next section provides recommendations based on the 
data analysis. 
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F. RECOMMENDATIONS BASED ON DATA ANALYSIS 

The recommendations based on the data analysis of the five components of 
internal control and the implications of differences in perceptions between AOs and CHs 
are presented below. 

1. Strengthen the Organization’s Control Environment 

In order to be a productive organization, management needs to maintain ethical 
values and cultivate trust with their employees. Although the management personnel in 
the GPCP may not be the AOs, who are direct supervisors of the CHs, it is imperative to 
act with integrity and strong ethical values to set an example for those who work within 
the GPCP. Based on the data analysis, there may be a lack of mutual trust and open 
communication between management and employees. Management should ensure that 
their communication plan and organizational goals are transparent and communicated 
throughout the organization. In addition, the reporting relationships should be clearly 
identified so employees may feel comfortable communicating with their supervisor 
and other management personnel. This may increase employees’ trust and open 
communication with management. 

Another aspect of the control environment that should be addressed is the formal 
codes and policies that communicate ethical behavior and standards. A weakness 
identified by the data analysis is that employees may not have known the penalties of 
unacceptable behavior or if prompt action is taken when there is improper use of the 
purchase card. The codes of ethics and integrity should be periodically reviewed and 
acknowledged by signature from all employees. In addition, management should clearly 
communicate and disseminate information regarding processing and handling of an 
incident with the purchase card. 

2. Enhance Communication 

Information and communication should be taken seriously, so it is imperative to 
clearly communicate the organization’s mission, expectations, and strategies to all 
employees. The data analysis identified several areas of weaknesses within the 
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information and communication component; therefore, several recommendations are 
made to enhance communication within the GPCP. A message regarding the GPCP’s 
organizational structure and objectives should be generated out to AOs and CHs, and it 
should be clearly stated so that there are no misunderstandings or miscommunications. 
To increase understanding of the organization, management should also encourage AOs 
and CHs to read the existing policies and procedures regarding the GPCP, if they have 
not done so before. In addition, management should review changes to policies and 
procedures in both AOs’ and CHs’ meetings to generate a clear, unified message. 

Furthermore, CHs responded that interaction between management and their units 
did not enable them to do their jobs effectively. This may be an area of improvement for 
management to continue communicating clear objectives and maintain flexibility to 
enable CHs to do their job effectively. If a CHs’ AO is preventing them from doing their 
job effectively, there should be a means of communication outside of a direct supervisor. 
If an alternate line of communication is available, that information should be 
disseminated to all employees. 

Finally, the purpose of information and communication is to distribute 
information at the right time and to the right people in order to carry out roles and 
responsibilities. An identified potential weakness is that management may not be 
informed of their units’ performance. Management may be unable to make the most 
informed decision if they are unaware of their employees’ units’ actual performance and 
do not receive timely reports. In order to strengthen that perceived weakness, a report or 
spreadsheet should be provided to management with weekly or monthly progress based 
on objectives set by the unit or the GPCP. It is imperative that management receives 
operating information to determine the organization’s level of compliance with laws and 
regulations. Ensuring that the units’ data and performance measures are valid and reliable 
is crucial to making informed decisions. 

3. Realign Government Purchase Card Program Structure 

The GPCP organizational structure should be realigned to balance the number of 
departments and number of people that each CH supports. The data analysis indicated 
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that 38% of participants, all of whom were CHs, spent 75% of their working hours 
conducting GPCP collateral duties. In addition, CHs responded that they felt 
unreasonable pressure to get the job done, and they did not have enough time in the day 
to perform all their duties, including collateral duties. To increase productivity, the 
program structure should identify the CHs who may be overworked and spending more 
than half their working day on GPCP collateral duties, and reorganize it to balance the 
purchasing support. The organization should ensure that CHs receive clear objectives and 
have a reasonable amount of time to complete their duties, including collateral duties. 
This recommendation may increase productivity in both the CH’s primary and collateral 
duties. 

Furthermore, another recommendation for realigning the GPCP structure is to 
ensure all AOs and CHs are properly trained and equipped with the necessary tools and 
information to achieve their goals. In order to maintain productivity and achieve their 
units’ objectives in the absence of an AO or CH, information should be available to the 
units’ end users regarding points of contact and proper procedures that should be 
followed in their absence. Each unit may not have more than one CH; therefore, the 
organization should also ensure that all pertinent information is available to both AOs 
and CHs when needed. 

G. SUMMARY 

In this chapter, the results of the online survey collected from LimeSurvey were 
presented, which included survey items pertaining to demographics and the five 
components of internal control. The overall population’s mean of the Likert-based 
responses in addition to the frequency of the demographics survey items were identified. 
The mean for each of the five internal control components were also calculated and 
presented. The mean and frequency of responses from the AOs and CHs were compared 
and analyzed to identify any differences in perceptions to internal controls between AO 
and CH. Additional analysis based on the results was discussed. Furthermore, any 
potential implications of internal controls, or lack thereof, on auditability within the 
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Government Purchase Card Program (GPCP) at the Naval Postgraduate School (NPS) 
were addressed. Finally, recommendations based on the data analysis were presented. 
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VI. SUMMARY, CONCLUSIONS, AND AREAS 
FOR FURTHER RESEARCH 


A. SUMMARY 

The Department of Defense (DOD) and the Department of the Navy (DON) 
purchase card programs process hundreds of thousands of transactions accounting for 
billions of dollars annually. In 2013, the federal government’s 300,900 cardholders (CHs) 
spent $16.5 billion on 18.9 million transactions (GSA, n.d.-c). In FY20I2, the Naval 
Postgraduate School (NPS) Government Purchase Card Program (GPCP) was responsible 
for making approximately 21,000 transactions totaling approximately $24.2 million (M. 
Morales, personal communication, July 24, 2013). Approving Officials (AOs) and CHs 
play an important role in the success of the GPCP. Additionally, in order for the GPCP to 
be successful, there must be sufficient corporate governance, specifically effective 
internal controls and auditability. The purpose of this research was to determine whether 
there were differences in perceptions between AOs and CHs regarding internal controls 
within the GPCP at NPS. 

B. CONCLUSIONS 

Although there were slight differences in the survey item means between AOs and 
CHs, there is still practical significance to all of the findings. The AOs consistently 
responded higher than the CHs with regard to the five internal control components. This 
section briefly provides conclusions as they relate to the research questions. 

• What are the differences in perceptions of internal controls between the 
approving officials and cardholders in the Government Purchase Card 
Program at the Naval Postgraduate School? 

There were slight differences of perceptions of internal control between AOs and 
CHs within each of the five internal control components. However, there were eight 
significant differences in perceptions of internal controls between AOs and CHs. They 
were identified in three of the five internal control components: risk assessment. 
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information and communication, and monitoring activities. The research findings 
revealed that AOs consistently responded more positively to internal controls in the five 
internal control components than CHs, implying that AOs perceive the strength of the 
internal controls to be stronger than the CHs perceive them to be within the NFS GPCP. 

• What are the implications to auditability from the differences in 
perceptions of internal control between approving officials and 
cardholders within the Government Purchase Card Program at the Naval 
Postgraduate School? 

Both strong and weak internal controls have implications on auditability. There 
were survey items to which both AOs and CHs responded strongly agree, which included 
such things as password protection, separation of duties, and adequate fraud education. 
However, the absence of effective internal controls can expose the purchase card program 
to inefficiencies and vulnerabilities to fraud, which would impact auditability in the 
organization. Weaknesses mentioned in the implications of findings could lead to 
employee’s making mistakes somewhere along the process, creating possible fraud, 
waste, and abuse, and further hindering the organization’s auditability. Any differences in 
perceptions between AOs and CHs can have an impact on auditability within the GPCP. 
The following section suggests areas for further research. 

C. AREAS FOR FURTHER RESEARCH 

The following areas for further research are suggested: 

One area for further research is to expand the survey to other DON organizations 
to analyze the differences in perceptions of internal controls within the organizations’ 
purchase card program. The expansion of the survey population would provide more data 
and potentially identify similar perceived trends within each organization’s purchase card 
program. In addition, this research would potentially provide insight into each 
organization’s internal control system and identify the strongest and weakest components 
of internal control. 
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Another area for further research would be to expand the potential survey 
participants at NPS to include purchasing agents within the contracting office. This 
addition would increase the number of potential participants and provide additional 
information from those who purchase full-time and have warrants for purchases greater 
than $150,000. This line of research would allow for a more diverse analysis between the 
perceptions of AOs, CHs, and purchasing agents. 
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APPENDIX A. INDUSTRY P-CARD PROCESS 
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Figure 14. Industry P-Card Process (from NAPCP, 2013b) 
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APPENDIX B. COSO’S 17 FUNDAMENTAL PRINCIPLES 
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Figure 15. COSO’s 17 Fundamental Principles (after COSO, 2013; Tan, 2013) 
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